Quality Manual # QS MD Logistics, Inc. (Signed copy available upon request) Prepared by Robert Grange, Director Quality

Transcription

1 # QS001.3 MD Logistics, Inc. (Signed copy available upon request) Prepared by Robert Grange, Director Quality Date Review indicates that qualified persons from operational areas have reviewed the content for accuracy, clarity, and the ability to implement as written. Reviewed Jeff Luthman, VP Operations/Business Development Date Approval indicates appropriate personnel participated in preparation and review, and that the content is aligned with organizational objectives. Approved Mark Sell, CEO/President Date

2 Revision History REVISION HISTORY Rev Description of Change Author Effective Date 0 Initial Release Robert Grange 31-Oct-06 1 Updated per Periodic Review Robert Grange 31-Dec-08 2 Updated per Periodic Review Robert Grange 31-Dec-10 3 Updated per Periodic Revew Robert Grange 1-Apr-12 2 of 39 QS001.3

3 Table of Contents Topic Page Topic Page TITLE PAGE/APPROVAL PAGE 1 QUALITY SYSTEM ELEMENTS 23 REVISION HISTORY 2 Risk Management 23 TABLE OF CONTENTS 3 Quality Unit Responsibilities 23 PREFACE 4 Quality Tracking 26 VISION & MISSION 5 Quality Metrics 27 INTRODUCTION 6 Internal Audits 28 Scope and Organization 6 GMP Service Providers & Vendors 29 Quality System Overview 7 Quality Agreements 30 MANAGEMENT CONTROLS 8 Deviation 31 Quality System Management 8 Change Control 32 Job Descriptions 9 Validation 33 Signature Logs 10 Batch Disposition 35 Record Retention 10 Stability 35 Management Review 12 Good Documentation Practices 36 TRAINING 12 Notification to Management 37 MATERIAL CONTROL 14 Housekeeping 37 PROCESS FLOW DOCUMENTS 15 Do Not Ship and Quarantine 37 PROCESS CONTROL 16 Periodic Review 38 PACKAGING AND LABELING CONTROL 17 Complaints 39 EQUIPMENT CONTROL 18 Recalls 39 COMPUTER SYSTEMS 20 3 of 39 QS001.3

4 Preface The Quality Manual (QM) describes the requirements of the MD Logistics (MDL) Quality System. The Quality System is a management tool designed to assure that: Products and services meet customer requirements Products and services are consistently and accurately processed Change is managed appropriately Errors are detected and corrected Products, services, and processes are continuously improved The Quality System described in this manual is also designed to assure compliance with the following: 21 CFR Part 11, Electronic Records, Electronic Signatures 21 CFR 205, State Licensing of Wholesale Prescription Drug Distributors 21 CFR 207 Registration of Drug Establishments 21 CFR 210, cgmp for Manufacturing, Processing, Packing, or Holding of Drugs 21 CFR 211, cgmp for Finished Pharmaceuticals 21 CFR 820, GMP/Quality Systems FDA Guidance for Industry Q7A ICH Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients (APIs) The National Association of Boards of Pharmacy Verified-Accredited Wholesale Distributors guidelines This QM supersedes The MDL Quality Management Systems Manual revised on December 31, The QM is owned and maintained by the Director of Quality. The Director of Quality authorizes the initial adoption of the QM, as well as subsequent reviews and changes. 4 of 39 QS001.3

5 Corporate Vision MD Logistics will be recognized for consistently providing customized supply chain solutions that meet our customers ever changing logistics needs. We will achieve sustainable growth through new opportunities and continued productivity advancements. Corporate Mission At MD Logistics, our mission is to support our team of leaders, dedicated to each other and our customers, in order to remain fast and flexible while providing custom supply chain solutions in a high quality environment, on time, every time. Quality Mission To deliver the RIGHT MATERIAL, in the RIGHT CONDITION, to the RIGHT PLACE, at the RIGHT TIME, EVERYTIME. (4Rs and E). 5 of 39 QS001.3

6 Introduction Scope The QM describes quality requirements and quality system tools used by MDL to assure that products and services are consistently produced and controlled to the appropriate quality standards required by regulations, specifications and/or customer expectations. MDL Organization The following chart indicates the general reporting structure of the organization. The Quality Unit (QU) is a distinct organizational unit that reports to the company s ownership. Current organizational charts with specific names and more detailed information may be obtained from the human resources department. CEO VP/Distribution Operations VP Forwarding & Value Added Solutions Director of IT Director of Pharma Operations Director of Strategic Planning Director of Quality Director of Freight Forwarding Director Surface Transportation Director Shared Logistics Human Resources Manager Finance Manager Sales Managers Manager of Domestic Operations Operations Manager Operations Manager Plainfield Manager Staff Training & Development Manager Ocean Services Operations Manager Operations Manager Plainfield Manager International Air Operations Manager Cust. Ser. & Process Control Operations Manager Reno Manager Customs Brokerage The diagram above depicts the company s management team. The management team is responsible for balancing, integrating and prioritizing business requirements, ensuring alignment with the company strategy, managing workload, removing barriers, and providing resources. The management team is responsible for ensuring business objectives are met. These objectives include quality, safety, environmental, throughput, headcount, and financial targets. QU personnel are involved in daily operations, working with the area staff to ensure that operations are conducted in accordance with local procedures and standards. Continued on next page 6 of 39 QS001.3

7 Overview of the Quality System The MDL Quality System and associated procedures address quality objectives, management s commitment to achieving objectives, organizational goals, and the expectations and needs of customers. The activities governed by the Quality System are identified and documented in procedures. A procedures index is controlled and maintained and lists all applicable standard operating procedures (SOPs) for MDL. The Quality System is divided into 5 levels. The highest level is the QM. The QM addresses principals, philosophy, policy, theory, and requirements. The second level is administrative procedures which govern company-wide quality practices (e.g. change management, hiring prerequisites). The third level is the Standard Operating Procedure Level. The third level applies to tasks that need to be accomplished in order to maintain and operate processes and equipment (e.g., packaging, dock operations). The fourth level includes documentation and records from business activities. The documents and records may include, but are not limited to the following: Bills of Lading, Overage/Shortage & Damage reports, Labeling and Packaging Materials Records, Process Control Records, Equipment Cleaning and Use Records, Logbooks, Qualification Documents, Forms, and Job Aids. The fifth level is management review. Management review is a status report describing the state of quality and the performance of the quality systems. The Director of Quality prepares and presents the management review to the executive management team. Quality metrics and issues are addressed during management review. Structure of MDL Quality System Quality Manual Administrative Procedures Operating Level Procedures Records and Documentation Management Review 7 of 39 QS001.3

8 Management Controls, Quality System Management The MDL Quality System is comprised of the following: Quality Manual SOPs Supporting documentation Forms Management review Periodic Review It is recognized that industry practices, company commitments, management principles, and regulatory standards are in a constant state of flux, as such, all elements of the quality system must be controlled and undergo periodic review. The QM is the governing document for MDL s Quality System, and associated SOPs provide detailed instruction for key elements of the Quality System. As such, these elements must be controlled and undergo periodic review. The QM must be reviewed every two years. SOP s, work instructions, and forms are reviewed per procedure. Document Review Prior to approval, qualified persons in the Quality Unit and operational areas must review applicable revisions to the QM for the following: Content accuracy Clarity Ability to implement as written Document Approval The QM, and subsequent revisions, are approved by MDL s executive management team and the Director Quality to ensure that the QM: Was prepared and reviewed by qualified personnel Is aligned with organizational objectives. End of Section 8 of 39 QS001.3

9 Management Controls, Job Descriptions General Requirements MDL personnel have job descriptions. The Job Description includes, but is not limited to the following: Job Position/Position Title Job Position to whom the Position Reports Summary Essential Duties and Responsibilities Miscellaneous Duties Supervisory Responsibilities Qualifications Education and/or Experience Language Skills Mathematical Skills Physical Demands Work Environment The employee and immediate supervisor review the Job Description to assure: Understanding of the responsibilities contained within the job description Agreement that the job description accurately reflects the key responsibilities of the position Temporary employee roles require a job specification. The job specification includes the minimal requirements for a person to perform in the role for which they are being hired. Specifications are communicated to vendor staffing companies. 9 of 39 QS001.3

10 Management Controls, Signature Logs Signature Logs record the names, signatures and initials of MDL personnel involved, directly or indirectly, documenting GMP operations. Temporary employees who sign or initial GMP documents must also sign the signature logs. Signature Logs are maintained to provide traceability of any entry on a document to the individual who made it. Systems must be in place to ensure that the Signature Log is updated as new staff is added. Requirements The Signature Log is a record that contains the signatures and initials of individuals working in a department or area that enter data onto GMP records. The log contains printed or typed names of each individual, their respective signature and initials, and date. A Signature Log is required for each department for verification/identification of signature and initials. For a large department, a Signature Log may be created for each area. Facility management has the responsibility for the creation and maintenance of the Departmental Signature Log. Signature Logs are maintained in the facilities where used. Management Controls, Record Retention Once a product or service is complete and shipped, the only evidence of how that product or service was processed resides in documentation. Clear and easily understandable documentation is required to re-create critical order processing steps should the need arise due to an audit, investigation, or inspection. GMP and supporting documents are retained in a manner that: Ensures their legibility and security Allows them to be retrieved quickly throughout their required retention period Storage of Records GMP and supporting records may be filed as hard copy, in electronic media, or microfilm. Files are retained as GMP documents and are: Organized and up-to-date Secured Protected from destructive environmental conditions Continued on next page 10 of 39 QS001.3

11 Electronic Records This manual recognizes that not all operations performed within MDL are required to comply with CFR 21 Part 11. The manual also recognizes that some pharmaceutical operations currently comply with Part 11 and others do not. For those pharmaceutical operations that do not, no GMP decisions will be made based solely on electronic data, and no GMP records will be retained electronically. What follows are the requirements for Part 11 compliant systems, and the target objectives for those pharmaceutical operations not currently in compliance with Part 11. Electronic records/data are owned by the Information Systems (IS) department. The owner of electronic records/data ensure the following: Equipment and software used for storage and archival are documented. Data is stored according to applicable procedures for easy retrieval. Computerized system data is maintained as defined in the corresponding databases along with audit trails. Retrieved records preserve the content, as well as their meaning and scope for processing such as search, sort, or trend as per original design. Electronic records/data are generated by the computer system in a secure manner with time stamped audit trails which reflect the creation, modification, and deletion of records, providing for display, copying, and printing of records, along with audit trail tools as part of respective back up and restoration SOP s. Electronic records/data are made available in compatible media for review purposes. Computer systems employed for archival, retrieval, and reproduction of electronic records are compliant with CFR 21 Part 11 requirements to preserve the nature and content of the records. Periodic reviews of data accessibility continue until the record retention period for the data has been reached or the data are successfully transferred to another system. During the period following retirement from production use until disposal of the system, the review need only address security and record retention, including ensuring that data can be retrieved from the retired system. Availability of Records Each area must make data and information available for inspection by quality organizations and regulatory agencies, and ensure that files are easily and quickly retrievable. Retention Periods Records are retained per procedure. Any documents required for litigation of governmental investigations must be retained longer than the retention period specified in procedure if requested by legal consultants. Disposal of Records Records are removed and disposed of when the designated retention period has been reached. Disposal of records is treated as confidential waste. 11 of 39 QS001.3

12 Management Control, Management Review Management review is the foundation of the quality system. Management review assures management involvement in and awareness of quality improvement initiatives. Management review also provides feedback and follow-up to assure issues receive the appropriate attention and stay on track. Adequate allocation of resources, management attention, and managerial follow-up is essential to assuring quality systems perform as intended, and quality improvement initiatives are implemented on schedule. Scope Management review includes a periodic summary of the performance of the quality system as measured by quality system metrics. Monthly reviews are planned; however, frequency can be increased or decreased at the discretion of the Quality Director. The Director of Quality will be responsible for preparation and presentation of the management review to the executive management staff. Executive staff will discuss progress, develop course corrections, and develop additional action plans if needed. Training Regulatory agencies worldwide require that all personnel have the education, training and experience, or any combination thereof, to enable them to perform their assigned job functions. Curricula are established for all job functions to outline these training requirements. As such, MDL employs a training regimen that includes self-study, instructor led, and on-the-job training. Risk Management principles are applied when determining the required combination of education, experience, and training that is needed to qualify an employee to conduct an assigned task or duty. Risk management principles are also applied when determining the type of training to be utilized (e.g., leader-led, computer-based, on-the-job self-study) as well as the frequency of on-going practical effectiveness checks. As such, the extent of personnel qualification, type of training, and frequency of practical effectiveness checks need to be based on appropriate risk related to products being processed (e.g., proximity to product, detect ability), the stage and type of processing being executed, and the risk to product quality. Continued on next page 12 of 39 QS001.3

13 Scope Each employee is assigned curricula(s) that outline training requirements for the employee s job function and duties. All employees are trained prior to performing their job function, duty, or task within that function. The completion of training is assessed by the QU at its discretion. Training documentation contains original training records to demonstrate that employees have been trained to do their assigned job. Human resource files contain a history of employees education and experience. GMP training is provided for all employees involved in pharmaceutical operations, and is reviewed and approved by the QU. All employees go through an initial GMP awareness course and ongoing training, including a review of general GMP requirements. All contractors, consultants, and/or temporary employees must have the education, training, and experience, or any combination thereof, to enable them to perform their assigned job functions. The individual sponsoring the contractor/consultant/ temporary employee is responsible for determining any MDL-specific training requirements and communicating these requirements to the individual, assuring that they have been appropriately trained, and document the training. End of Section 13 of 39 QS001.3

14 Material Control Adequate control of materials is essential to assure product safety, identity, strength, purity, quality (SISPQ) and/or customer requirements. Material controls are applied to all aspects of materials management including but not limited to: replenishment, receipt, inspection, handling, storage, flow through facility, flow through processes, inspection of work-in-progress, final inspection, and order fulfillment. Risk management principles are applied when determining the appropriate level of controls needed to ensure that materials (e.g., labels, components) used in processing or packaging have a comprehensive approach for handling, evaluation, storage, and approval for the intended use. Specifically, risk management principles are applied through the process of classifying and approving vendors and suppliers, frequency and scope of on-going vendor and supplier audits, level of incoming testing, and degree of inventory control. As such, the extent of material management needs to be based on appropriate risk related to products being processed (e.g., temperature excursions, mix-ups), the stage and type of processing being executed, and the risks to SISPQ. Materials Control of materials used in operations is necessary in order to ensure processes operate as intended. Material controls in GMP areas are required for direct impact (see validation section for definition) systems. Material control systems include the following: Environmental Control Systems Inventory Control Systems Security Systems. The QU has the responsibility to ensure materials meet the quality specifications established. Product Protection Control Adequate materials management techniques, use of electronic quality holds and quarantine areas, appropriate redundancy and alarming for critical controls, and appropriate shipping controls will be utilized to assure materials are fit for intended use, and SISPQ is not compromised. 14 of 39 QS001.3

15 Process Flow Documents Process Flow Documents (PFD) are drawings that depict unit operations and the flow of resources throughout a process. Processes must be well defined and understood in order to operate reliability and consistently. Process flow documents (PFD) will serve as the foundation for defining, understanding, and improving MDL processes. PFDs will also serve as a communication tool to describe the critical controls in place to assure consistent operation and outcomes. Scope PFDs will be developed for processes that involve marketed products or services. Requirements The following shall be included on finished PFDs: Inputs Flow of materials Flow of people Flow of or use of equipment Critical control points Control strategy Procedures and use points in the flow Handoffs/Handshakes defined Desired output Acceptance criteria for output Output metrics Metrics tracking and communication 15 of 39 QS001.3

16 Process Control Written procedures, segregation, and second-person-verification (SPV), are examples of controls designed to ensure that products and services conform to requirements. Controls are followed and appropriate documentation occurs at the time of performance. Processing Requirements Procedures and process controls include but are not limited to component segregation, inspection, and material identification. Critical control activities are adequately supervised. Each critical container or component dispensed to processing lines is second person verified (SPV) to ensure proper release by the QU, correct count or measure, proper identification, and appropriate addition to the processing area. Actual output is compared to expected output. Such calculations are verified by a second person. Deviations in output are investigated to determine their impact on quality. Storage areas, processing lines and major equipment used in the processing of a batch are identified. Where appropriate, established time limits are met to ensure product quality. Deviations from established time limits are documented and evaluated. Sampling and Testing of In- Process Materials In-process controls and their acceptance criteria are defined. The type and extent of inspection depends on the nature of the product, the step being conducted, and the effect the process variation has on product quality. The QU approves acceptance criteria. Operational departments perform some in-process inspection. Adjustments may be made within pre-established limits that have been approved by the QU. Sampling plans are based on scientifically sound practices and are designed to prevent contamination of the sampled materials. Rejected in-process materials are identified and controlled under a quarantine system designed to prevent their unintended use. Mix-Ups/ Contamination Operations are conducted in a manner to prevent mix-ups and contamination. Rework/ Reprocessing Reprocessing occurs with review and approval of the QU. Introducing material back into the process for repeat of a unit operation is preceded by careful evaluation to ensure that quality is not adversely affected. Acceptance criteria for reprocessed materials are equivalent to the original acceptance criteria Before reworking a batch (subjecting to one or more steps different from the established process), an investigation into non-conformance is performed. Reworked lots are subjected to appropriate evaluation, comparison to the established product profile, if warranted, and documentation to show product equivalence to that derived from the original process. Concurrent validation is often the correct approach for reworked materials, and will be employed at the discretion of the QU. 16 of 39 QS001.3

17 Packaging and Labeling Control The QU is responsible for insuring that all packaging and labeling materials conform to established specifications. Records are maintained for each shipment of labels and packaging materials. Packaging Materials Containers provide adequate protection against damage, deterioration, or contamination. Containers must not be reactive, additive or absorptive. Containers are clean, and, where appropriate, sanitized. Label Issuance and Control Access to label creation areas is limited. All excess labels are destroyed. If label quantities cannot be reconciled, the disparity is investigated, and the QU approves the investigation. Printing devices for labels are controlled. Printed labels issued for a lot are carefully examined for proper identity and conformance to specifications. Packaging and Labeling Operations Labeling operations are designed to prevent mix-ups. There is physical separation from operations involving other products or batches during processing. Packaging and labeling facilities are inspected immediately before use to ensure that all materials not needed have been removed. The results of this inspection are documented. Packaged and labeled products are inspected, and the results are documented. 17 of 39 QS001.3

18 Equipment Control In order to generate reproducible and valid results, it is necessary that all processing and inspection equipment is capable and suitable for its intended purpose. Equipment systems are categorized by the QU as being direct, indirect, or no impact, and equipment within the system is further categorized as process critical, and non-critical depending on the risk that the equipment poses to product SISPQ. Equipment is designed, purchased, commissioned, and qualified based on this risk assessment. The on-going cleaning, monitoring, and maintenance programs are designed around the impact assessment and classification. The applicable Periodic Review process (defined on page 38) verifies that the above activities and initial risk assessment are correct or need to be changed. Equipment Design, Size and Location Equipment used in processing, packaging, or labeling is of appropriate design and adequate size, and suitably located for its intended use, cleaning, sanitation (where appropriate), and maintenance. Equipment is qualified to ensure that it is installed correctly, operates as required, and performs as expected under processing conditions. Equipment is constructed so that surfaces that contact components are not reactive, absorptive, or additive so as to alter the SISPQ of the components beyond established specifications. Equipment is used within its qualified operating range. Equipment is uniquely identified with regard to its type, use, and location. A current set of drawings is maintained for equipment and critical installations. Any substances associated with the operation of equipment (e.g., lubricants, heating fluids, coolants) must not contact the product or product packaging. Where deemed necessary and feasible, food grade lubricants and oils are used. Equipment is designated by the QU as critical or non-critical. Periodic reviews (PR) of critical equipment are conducted by trained personnel, reviewed by qualified personnel, and approved by the QU. The purpose of equipment PR is to confirm that equipment remains in a qualified state and is suitable for its intended use. Equipment PR examines the state of qualification of critical components in a direct impact system. Change controls, deviations, drawings, and maintenance history are reviewed in order to assess if there are signals or indications that suggest there has been a shift in equipment performance away from a qualified state. Continued on next page 18 of 39 QS001.3

19 Equipment Calibration Calibration procedures include specific directions and limits for accuracy and precision. Calibration standards used for inspection, measuring and test equipment are traceable to national or intrinsic standards. Calibration records are maintained documenting the following: Equipment identification Calibration dates Individual performing the calibration Next calibration date Control, weighing, measuring, monitoring, and testing equipment critical for ensuring quality is calibrated according to written procedures and an established schedule. Equipment calibrations are performed using standards traceable to certified standards, if they exist. Records of these calibrations are maintained. The current calibration status of critical equipment must be known and verifiable. Instruments that do not meet calibration criteria are not used. Deviations from approved standards of calibration of critical instruments are investigated to determine the effect on product SISPQ using this equipment since the last successful calibration. Equipment Maintenance and Cleaning Risk management principles are applied when determining the appropriate level of maintenance activities needed to ensure that equipment is properly maintained and repaired to meet its intended use and ensure reliability. Risk management principles are applied when purchasing equipment, selecting level of rigor for system maintenance strategy development, applying preventive maintenance techniques, determining spare parts stocking levels, conducting root cause analysis, and communicating maintenance activities. As such, maintenance activities need to be based on appropriate risk related to product/service quality. Schedules and procedures are established for maintenance of equipment. Maintenance operations must not present any hazard to the safety of personnel or quality of the product. 19 of 39 QS001.3

20 Computer Systems This manual recognizes that not all operations performed at MDL are required to comply with CFR 21 Part 11. The manual also recognizes that some pharmaceutical operations currently comply with Part 11 and others do not. For those pharmaceutical operations that do not, no GMP decisions will be made based solely on electronic data, and no GMP records will be retained electronically. What follows are the requirements for Part 11 compliant systems, and the target objectives for those pharmaceutical operations not currently compliant with Part 11. Persons who use computer systems to create, modify, maintain, or transmit electronic records employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Clearly defined roles and responsibilities for computer systems are developed by the Information Systems (IS) Department. Electronic Records Covered in this section are any GMP records created, modified, maintained, archived, retrieved, or transmitted in electronic form. Procedures and controls for computer systems contain the following features: Validation to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by regulatory agencies Protection to enable their accurate and ready retrieval throughout the records retention period Access limited to authorized individuals Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand Use of device (e.g., terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform assigned tasks The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification Use of appropriate controls over systems documentation, including controls over access to documentation and changes to the system Electronic signatures and handwritten signatures executed to electronic records are linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means. Continued on next page 20 of 39 QS001.3

21 Electronic Signatures Signed electronic records shall contain information associated with the signing that clearly indicates the printed name of the signer, the date and time when the signature was executed, and the meaning (such as review, approval, responsibility, or authorship) associated with the signature. General requirements include the following: Before an organization establishes, assigns, certifies, or otherwise sanctions an individual's electronic signature, or any element of such electronic signature, the organization must verify the identity of the individual. Each electronic signature must be unique to one individual and must not be reused by, or reassigned to, anyone else. Persons using electronic signatures shall, prior to or at the time of such use, certify to regulatory agencies that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures. Components and controls include the following: Electronic signatures that are not based upon biometrics shall: o Employ at least two distinct identification components such as an identification code and password o Be used only by their owners o Be administered and executed to ensure that attempted use of an individual's electronic signature by anyone other than its owner requires collaboration of two or more individuals Execution of an electronic signature: o When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing is executed using all electronic signature components; subsequent signings are executed using at least one electronic signature component that is designed and executable only by that individual. o When an individual executes one or more signings not performed during a single continuous period of controlled system access, each signing is executed using all of the electronic signature components. Persons who use electronic signatures based upon use of identification codes in combination with passwords shall employ controls to ensure their security and integrity. Such controls shall include the following: o Maintaining the uniqueness of each combined identification code and password, such that no two individuals have the same combination of identification code and password o Ensurance that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging) o Loss management procedures to electronically de-authorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls Continued on next page 21 of 39 QS001.3

22 Electronic Signatures (continued) o Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and detecting and reporting in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management o Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner Process Equipment Computer Systems GMP-related computerized systems must be validated. The depth and scope of validation depends on the diversity, complexity, and criticality of the computerized application. Quality and production platforms must be qualified. Appropriate installation and operational qualifications demonstrate the suitability of computer hardware and software to perform assigned tasks. Commercially available software that has been qualified does not require the same level of testing. If an existing system was not validated at the time of installation, a retrospective validation should be conducted if appropriate documentation is available. Where critical data are being entered manually, there is an additional check on the accuracy of the entry. This can be done by a second operator or by the system itself. Incidents related to computerized systems that could affect the quality of products or services, the reliability of records, or inspection results are recorded and investigated. Changes to computerized systems are made according to the change procedure and are formally authorized, documented, and tested. Records will be kept of all changes, including modifications and enhancements made to the hardware, software, and any other critical component of the system. These records demonstrate that the system is maintained in a validated state. If system breakdowns or failures result in the permanent loss of records, a back-up system must be provided. A means of ensuring data protection must be established for all computerized systems. 22 of 39 QS001.3

23 Quality System Elements, Risk Management Application The Quality Unit is responsible for risk assessment. Risk assessment will be applied to all aspects of the products and services offered by MDL. Risk assessment allows MDL to focus resources on those activities that will have the greatest impact on improving quality. Risk assessment requires an in-depth understanding of both physical and business processes for the determination of how a particular situation impacts the fitness for use of a product. Applications of risk management may include the degree of inspection of a particular process or system, level of training or verification to conduct a particular task, or level of sign-off for a decision. Application of risk management techniques are described throughout this manual, where applicable. The Quality Unit is responsible for developing risk assessment tools and techniques. Quality System Elements, Quality Unit Responsibilities The Quality Unit (QU) provides quality oversight for operations at MDL. The QU has the technical knowledge to critically assess operations. Decisions are based on technology and an understanding of current regulatory requirements. Role of the QU The QU is responsible for the establishment, maintenance and operation of the Quality System. This responsibility includes the following: Ownership of the quality system Assessment of the quality of products or services delivered Decisions that directly or indirectly impact the acceptability of products or services delivered Approval of GMP documents and data Approval of materials (i.e., raw materials, in-process materials and final products) QU personnel must be attentive to detail and ensure the quality of their own work. They must be diligent in ensuring that operations are in conformance with the requirements of the Quality System. They must stop work in progress or make appropriate notifications when non-compliant conditions exist or requirements are not being met. Continued on next page 23 of 39 QS001.3

24 Director of Quality Responsibilities The Director of Quality owns compliance and is ultimately responsible for adherence to cgmp and other applicable regulations. The Director of Quality has the authority, management support, knowledge and confidence to enforce the necessary operational discipline and ensure compliance. Key responsibilities for the Director of Quality are as follows: People o Staff operations with a sufficient number of individuals that have the education, skills, and core competencies to drive quality objectives o Manage organizational structure to align resources with objectives o Define responsibilities of all QU personnel in job descriptions o Ensure the QU staff members are appropriately trained and competent o Utilize Human Resources tools to ensure that the right individuals are in the right job (e.g., Performance Management, Merit Delivery, Talent Assessment, Succession Planning and Staffing) Compliance o Ensure and check that fundamental requirements are met in each department through adherence to written procedures o Develop and implement,a tracking mechanism to ensure that quality commitments are met o Ensure that deviations are investigated and corrective actions are implemented o Determine the potential for impact to product safety, identity, strength, purity and quality (SISPQ), and halt operations, if necessary, to resolve any quality issue that has the potential to impact product SISPQ o Report on the status of the quality backlog o Represent company leadership in internal and external inspections o Manage notification to management and ensure appropriate escalation of issues o Lead vendor, third party and GMP service provider audits o Provide review of required quality documentation (e.g., procedures, quality agreements) o Participate in area internal audits, and provide follow-up on completion of action items Business Partnership o Implement a shared quality vision with business partners o Coordinate Quality activities o Report quality metrics o Consult on the relative priority of quality action items, providing justification for additional resources if required o Align Quality initiatives with business plans Technical Excellence o Maintain awareness of GMP trends o Participate on teams, committees, or groups to achieve departmental or company goals o Attend industry or professional organization meetings o Benchmark internal and external best practices Continued on next page 24 of 39 QS001.3

25 Quality Unit Representative The QU Representative (QU Rep) is the front line of quality for site operations. The QU Rep is involved in daily operations and decision-making, working with the area operational staff to assure that operations are conducted in accordance with local standards. Key responsibilities for the QU Rep are as follows: Compliance o Monitor daily activities in the area, and communicate and escalate issues to quality and operations leadership o Conduct quality assessments of systems and controls o Review and approve specifications o Check for adherence to written procedures through self-inspections and assessments o Periodic review of GMP-related data in the area. o Develop, implement, monitor and modify Quality action items in area of responsibility o Determine deviation level, and ensure that investigations are complete and that corrective actions are implemented o Approve Level 1 deviations and changes o Provide review of required quality documentation (e.g., deviations, change controls, validation/qualification packages, area or equipment operating procedures, and drawings) o Participate in area self-inspections and assessments o Participate in vendor, third party and GMP service provider audits in area o Evaluate process excursions for potential impact to product SISPQ o Identify quality backlog items and update status through completion Business Partnership o Participate on process or area teams o Align area Quality objectives with business objectives Technical Excellence o Maintain awareness of GMP trends o Understand the impact of products or services delivered by the area on other areas o Participate on teams, committees, or groups to achieve departmental, site or company goals o Attend industry or professional organization meetings o Benchmark internal and external best practices o Maintain sound technical understanding of the area s processes 25 of 39 QS001.3

26 Quality System Elements, Quality Tracking Log The Quality Tracking Log is a quality management tool used to organize and track MDL s quality projects and action items. The purpose of the Quality Tracking Log is to document the quality actions or initiatives that will be completed to close compliance gaps, meet corporate commitments, meet customer commitments, or improve practices to keep current with industry standards. There are many sources of action items for the Quality Tracking Log which may include but are not limited to; site gap assessments, internal audits, external audits, corrective and preventative action (CAPA) trends, and deviation trends. Actions or initiatives are recorded chronologically and reference the source of the action (e.g. customer audit, internal audits). The implementation time frame is tracked by specific dates. The current month s performance is tracked and reported during monthly management reviews. The Director of Quality oversees tracking of action items. Quality Tracking Color indicators are used to track Quality action items where: White = Action/initiative is cancelled. Green = Action/initiative is in progress. Red = Action/initiative is behind schedule. Blue = Action/initiative is complete. 26 of 39 QS001.3

27 Quality System Elements, Quality Metrics Quality Metrics Quality metrics are measurements related to product/service quality, and quality system performance. (e.g., percentage of kits packaged properly, percentage of on-time shipments). The purpose of quality metrics is to measure continuous improvement. Improvement is indicated as the measurement value goes in the desired direction. Metrics also serve as and early warning system if measurement values move in the wrong direction. The QU provides monthly quality metrics that include the following: Deviations o Deviations occurring during the period o Deviations exceeding target closure date o Corrective/Preventative Action Items behind schedule Change Control o Changes occurring during the period o Changes exceeding target closure date Action items overdue SOPs overdue QU approvals overdue Additional quality metrics are reported, as requested. 27 of 39 QS001.3

28 Quality System Elements, Internal Audits Internal audits are inspections to determine compliance with applicable policies and procedures. The goal of auditing is to identify and resolve quality issues internally, thus improving inspection readiness. Audits are conducted to assess area practices for compliance to applicable policies, procedures, regulations, and customer expectations. Self-assessments check for understanding of practices, processes, and techniques. They also provide a mechanism for immediate, constructive feedback to the area. Risk management principles are applied to the internal audit program. Frequency and scope of assessments take into account such factors as overall compliance states of individual quality systems; compliance history of the area being assessed; results of previous audits; assessment of performance metrics, deviations, and significant changes; and time since previous assessment. The Director of Quality is responsible for ensuring that internal audits are conducted. Audits are typically conducted using a systems approach. Internal Audits Internal audits are performed by the QU. Internal audits are intended to be comprehensive assessments of area s inspection readiness. An internal audit is conducted at least annually. The systems included in the audit, at a minimum, are the following: Quality Facilities, Utilities, Maintenance, and Equipment (FUME) Processes Materials Computer Systems Area Management is responsible for making resources available to facilitate the internal audit process, respond to findings, and ensure that corrective actions are completed. Audit observations and corrective actions are documented per procedure. 28 of 39 QS001.3

29 Quality System Elements, GMP Service Providers and Vendors MDL provides products and services as a GMP service provider, or as a third party logistics (3PL) provider. As such, MDL does not approve materials or services other than to meet the storage conditions and acceptable excursion times provided by customers. In virtually all cases, MDL s customer specifies the products or service providers MDL is required to use. In cases where MDL is responsible to evaluate GMP service providers or vendors, those evaluations will occur per procedure. The need to perform a supplier audit is based on risk assessment. Scope GMP Service Providers (GSPs) include, but are not limited to, the following: Architectural and engineering firms providing design services Maintenance firms providing instrument calibration Firms supplying transportation services Firms preparing and conducting validation or equipment qualification Firms supplying components which do not form the device or combination device/drug product item Engineering firms which provide external devices GMP consultants Vendors include, but are not limited to, the following: Raw material suppliers Packaging component suppliers Equipment suppliers Quality Requirements The QU ensures that a program is in place to approve and manage all GSPs and vendors. The approval or non-approval of GSPs and vendors must be made prior to use and documented. Responsibilities and expectations between MDL and the GSP or vendor are documented in written agreements. This may be in the form of the purchase order or a formal quality agreement. Continued on next page 29 of 39 QS001.3

30 Audits The QU, along with appropriate technical experts if necessary, determines and documents the GMP impact and significance of each product or service on the operation. Based on this assessment, the need to audit GSPs and vendors is determined. When an audit is required, GSPs and vendors are audited prior to use, and are part of an ongoing monitoring program. The initial audit must identify any significant issues that may preclude MDL from utilizing the GSP or vendor. The QU manages initial and ongoing audits. GSPs and vendors are audited at a frequency, dependent upon the impact to product quality. Existing Vendors and Suppliers This manual recognizes that MDL currently uses vendors and suppliers that have not been assessed according the requirements of this quality manual. Current vendors and suppliers will be considered acceptable unless performance indicates quality issues. Current GMP vendors and suppliers will be included in the vendor assessment program by conducting assessments as a part of periodic review. Quality System Elements, Quality Agreements Quality agreements may be written to provide suppliers, customers, and MDL a method to define and document roles and responsibilities. 30 of 39 QS001.3

31 Quality System Elements, Deviations Deviations are unplanned events or departures from established standards and practices. Deviations are the core of continuous improvement efforts. The ability to identify and the discipline to record, investigate, and track unplanned occurrences is vital to improving operations. The extent of the deviation investigation and the level of documentation required must be commensurate with the scope and criticality of the occurrence. Using a risk-based analysis, deviations are classified as one of three levels, which are based on SISPQ impact to the product. Each level is increasingly more critical to product quality and requires progressively more rigorous investigation and documentation. Requirements Deviations are classified as Level 1, Level 2, or Level 3 deviations, based on the criticality of the departure. Level 1 deviations are defined as deviations that have readily available information to justify no impact to product SISPQ. Level 2 deviations are defined as deviations that require additional investigation to ensure product SISPQ is not impacted. Level 3 deviations are defined as deviations that are suspected to have impact to product SISPQ such that product may not be fit for use. Deviation investigations must include the following: The batch numbers of material that may be impacted Whether any regulatory commitments or customer specifications were violated An evaluation of the quality of the impacted batches and a recommended batch disposition with appropriate justification An evaluation of the impact on the validation of the process, inspection method, process automation/ computer system, cleaning methods, equipment/utilities or environmental monitoring process qualification Deviations require a root cause analysis investigation be performed, and that preventative actions be developed, as appropriate, to prevent recurrence. 31 of 39 QS001.3

32 Quality System Elements, Change Control Change is defined as a planned alteration, origination of a new methods, facilities, utilities, equipment, computer systems, records or controls that are used to produce marketable products or services. Using a risk-based analysis, changes are classified as one of three levels, which are based on SISPQ impact to the product. Each level is increasingly more critical to product quality and requires progressively more rigorous documentation and levels of approval. Like for like replacements are not considered to be changes and do not require change control. Requirements Each Change Proposal must be classified based on risk. The rationale for the change classification must be documented in the Change Description and is determined by the Change Owner and the appropriate QU Representative. The levels of classification are based on the impact to product SISPQ. The levels of classification are described below: Level 3 - changes that have a high risk of impacting product SISPQ. Level 2 - changes that have a medium risk of impacting product SISPQ. Level 1 - changes that have a low risk of impacting product SISPQ. Revision/Correction - changes are document corrections or changes that do not affect SISPQ systems and do not require a risk analysis. No change control is required for revision/correction changes. Changes must include the following: Change Proposal identification number Description of the change Impact analysis of the change on product/service and regulatory or customer commitments Identification of all material that will be impacted Justification for making a change along with any supporting data to show the proposed change meets safety, GMP and environmental practices, and any other applicable standards and regulations. In the case of GMP equipment or processes, an evaluation of the impact of the change on the validation or qualification state including identifying the need for re-validation or requalification must be performed Actions to implement the change Review and approval of the change The process assures all criteria in the change proposal are met prior to approving implementation of the change and closure of the change control. 32 of 39 QS001.3

33 Quality System Elements, Validation Process validation is documented evidence that a process operates reproducibly and generates a product or service meeting predetermined specifications and quality attributes. Prospective validation is normally performed for all processes before distribution; however, concurrent validation may be used. Risk management practices are applied to validation by establishing acceptance criteria based on the risk to product quality. Risk assessment is used to ensure the appropriate level of validation is applied to each stage in the process and takes into account early stage processes and the remaining down-stream processing. The frequency of revalidation of the process is determined based on process performance and risk assessment of the equipment, systems, and materials during periodic reveiw. Validation/ Qualification/ Commissioning Processes and equipment are to be validated, qualified, or commissioned appropriately. In general, validation in the most rigorous and will be performed based on regulatory requirements, customer requirements, and risk assessment. Normally, validations require an installation qualification (IQ), an operational qualification (OQ), and a process qualification (PQ). Qualification requires an IQ/OQ, and commissioning requires a documented verification that systems are installed and operating according to design specifications. The following along with consultation of the QU will determine which of the three is appropriate. A direct impact system is a system that directly contacts drug product and labeling. Direct impact systems can be identified by the QU as systems that preserve product SISPQ, or that affect performance, reliability, effectiveness or durability. Systems which produces data that is used to accept or reject product are also considered direct impact systems.. An indirect impact system is a system that supplies a utility or function to a direct impact system, or otherwise affects the performance of a direct impact system. For direct impact systems, validation is required. For direct impact or critical component equipment, qualification is required. Indirect impact processes, utilities, and equipment, are commissioned at the discretion of the QU. Continued next page 33 of 39 QS001.3

34 Process Validation A written validation protocol is established to specify how the validation of a particular process will be conducted. The protocol is reviewed and approved by the area manager and the QU. The protocol specifies critical process steps and acceptance criteria. Supporting documentation for the Validation Protocol will include the Process Flow Document(s), Operational Forms, SOPs and Preventative Maintenance Schedules. A validation report that cross references the validation protocol is prepared, summarizing the results obtained, commenting on any deviation observed and drawing the appropriate conclusions, including any changes needed to correct deficiencies. Any variation from the validation protocol is documented with appropriate justification. Prior to conducting process validation, appropriate qualification of critical equipment and ancillary systems must be completed. Systems and processes are periodically evaluated to verify that they are still operating in a valid manner. Where no significant changes have been made to the system or process, and periodic review confirms that the system or process is consistently producing material meeting its specification, there is normally no need for revalidation. Significant process changes including a change in equipment or materials that may affect product quality and/or the reproducibility of the process must be validated. Operations Management and the QU approve proposed validation protocols. Cleaning Validation MDL provides products and services as a GMP service provider, or as a third party logistics (3PL) provider. Because of the nature of the industry in which MDL participates, MDL does not conduct cleaning validation. 34 of 39 QS001.3

35 Quality System Elements, Batch Disposition The QU examines each batch of processed materials to determine that quality is satisfactory for the intended use and meets the established requirements. Risk management principles are applied by the authorized QU representative to approve or reject batches. The Director of Quality must authorize individuals in QU to approve or reject batches. Their authorization and qualification (education, training, and experience) must be documented. As part of batch disposition, the QU reviews and evaluates information related to the production of that batch, including the following: Batch Records In-process checks Certificates of Testing Certificate of Analysis Deviations Batch-Related Changes Final Yield Requirements The QU has the following responsibilities and authority for batch disposition (including, but not limited to): Disposition all finished goods, and provide for the review and disposition of raw materials, and process intermediates Assure the review and approval of all product batch records (e.g., production documentation, control records, test results, change controls, and deviation reports) before product is released For a batch to be released, the batch release determination or decision must be assigned as one of the following three types: Approved Do Not Ship Quarantine Batches not suitable for approval must be rejected, reworked, or reprocessed. Quality System Elements, Stability MDL provides products and services as a GMP service provider, or as a third party logistics (3PL) provider. As such, MDL does not offer stability services other than to meet the storage conditions and acceptable excursion times provided by customers. 35 of 39 QS001.3

36 Quality System Elements, Good Documentation Practices Clear, accurate and complete documentation is required to ensure consistency and effective control of all processing, storage and distribution operations, and must be able to, at a later date, clearly, accurately, completely and quickly recreate an action or decision using available documentation. Documentation of all completed process steps, controls and required data are essential in order to provide an audit trail that permits subsequent tracking and investigation of product. Requirements All entries on GMP documentation must meet the following requirements, at a minimum. General documentation requirements include the following: o Documentation is accurate o All entries are made at the time action is taken o All entries are clear o All entries are made onto the proper document, form, or computer system o All documentation is made using permanent blue or black ink o All entries must be legible and permanent o All required entries must be made, and blanks are not acceptable o Entries to document completion of work tasks must be initialed o Actual values or observations must be recorded in support of pass or fail results, whenever possible o All manual calculations must be documented, including, but not limited to, units of measure, conversion factors and equivalency factors All notations, corrections or comments on GMP documents must: o Be initialed and dated o Preserve the original entry o Provide the reason for the change in cases where the reason is not obvious to people familiar with the industry (e.g., correction, entry error) 36 of 39 QS001.3

37 Quality System Elements, Notification to Management MDL has several quality and operational controls in place to ensure the SISPQ of products and services. When an element of quality or operational control fails or is in question, management personnel must be notified. Responsible persons are accountable to ensure that appropriate action is taken to maintain the SISPQ of products produced. For GMP operations, notification to management is initiated promptly and efficiently to ensure management awareness of issues that potentially affect patient safety. A notification to management procedure ensures consistent documentation and management level notification. Risk management is employed to determine the appropriate level of notification based on the issues potential to affect patient safety. Issues deemed to have the highest potential to impact patient safety receive the highest level of management notification. This risk-based approach allows the highest level of quality management to facilitate risk communications, determine appropriate actions and notify regulatory authorities when patient safety is potentially impacted. Roles & Responsibilities Each employee is responsible for informing supervision of any action that could affect product SISPQ, state of equipment qualification, or validation. Supervision is responsible for ensuring that issues that potentially impact SISPQ are escalated to appropriate management. Management is responsible for ensuring that appropriate action is taken to maintain the SISPQ of products produced. Quality System Elements, Housekeeping In order to maintain adequate facilities, area managers develop and maintain a good housekeeping program including, but not limited to, the following: Areas to be cleaned Cleaning equipment and agents Frequency Documentation Quality System Elements, Do Not Ship and Quarantine Do Not Ship and Quarantine are processes designed to prevent the use of materials that do not meet requirements. Equipment, materials, or product used in, or to support operations, are evaluated and determined to be suitable for their intended use. Any item that is deemed to be unsuitable for its intended use is removed from service, or identified as unsuitable for use until the item is replaced, repaired or adjusted to be suitable for its intended use. Do Not Ship or Quarantine status can only be removed by the QU. 37 of 39 QS001.3

38 Quality System Elements, Periodic Review (PR) The purpose of PR is to verify that the processes continue to produce products and services that meet established specifications. Process PR evaluates the combined effects of deviations, changes, maintenance, and corrective actions holistically to determine the impact to the process. Control procedures, monitoring plans, validation requirements, and alert levels are also evaluated to determine the need for change. In order to verify consistency of the process, PRs are to be conducted and documented. Periodic Revew serves as the basis for determining the need for changes that can result in process improvements, efficacy gains, and risk mitigation. Risk management principles are employed during the PR process to determine which process steps will receive a formal assessment as well as to prioritize follow-up actions and recommendations. Requirements The PR provides the opportunity to do a critical assessment of process performance data and to monitor product quality systems and control strategies to determine whether a process remains in a state of control (validation for GMP processes). A PR must be performed at least annually for each process and may be performed more frequently as quality management deems appropriate. The review includes the following: Spot batch analysis Process metrics Process flow document evaluation Validation evaluation (GMP processes) Unplanned events (e.g., deviations) Changes (e.g., specifications, change controls, equipment, methods) Complaints Inspection Methods (including work-in progress) Status of previous PR recommendations, as well as recommendations from the current PR A summary report that summarizes and captures the data above PRs are reviewed by area management and approved by the QU End of Section 38 of 39 QS001.3

39 Quality System Elements, Complaints A complaint is any communication from a patient or patient agent that describes a deficiency in or dissatisfaction with drug or device efficacy. In order to assure customer satisfaction and prevent customer defections, a system is in place to handle any complaints that allege deficiencies in product performance. This element of the quality system describes the process for the handling and investigation of complaints. MDL provides products and services as a GMP service provider to the pharmaceutical industry, or as a third party logistics (3PL) provider. As such, MDL s participation in complaints is limited. Client pharmacovigilence departments are informed in the event a complaint is received by MDL, and mechanisms are in place to do so should the need arise. MDL does not manage patient complaint processes for its clients. End of Section Quality System Elements, Recalls MDL provides products and services as a GMP service provider to the pharmaceutical industry, or as a third party logistics (3PL) provider. As such, MDL participates in recall, correction, or withdrawal activities by assisting customers with information and services to facilitate the recall process. MDL does not initiate or manage the recall process. Scope For in house operations at MDL, all employees are responsible for notifying supervision immediately of any information that could potentially result in a recall, correction, or market withdrawal. Information concerning a product defect that could potentially lead to a recall, correction, or market withdrawal includes, but is not limited to, any circumstance where the SISPQ, fitness for use, or performance of a marketed product is in question. Recalls, corrections, and market withdrawals may be initiated by customers at the request of a regulatory agency. MDL has identified the Director of Quality as the recall coordinator. The recall coordinator is responsible for coordinating recall activities with customers. End of Section 39 of 39 QS001.3